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Abstract — We  consider  the  problem  of  quickest  localization  of  anomaly 
in  a  resource-constrained  cyber  network  consisting  of  multiple  compo¬ 
nents.  Due  to  resource  constraints,  only  one  component  can  be  probed 
at  each  time.  The  observations  are  random  realizations  drawn  from 
two  different  distributions  depending  on  whether  the  component  is 
normal  or  anomalous.  Components  are  assigned  priorities.  Components 
with  higher  priorities  in  an  abnormal  state  should  be  fixed  before 
components  with  lower  priorities  to  reduce  the  overall  damage  to  the 
network.  The  objective  is  to  minimize  the  expected  weighted  sum  of 
completion  times  of  abnormal  components  subject  to  error  probability 
constraints.  We  consider  two  different  anomaly  models:  the  independent 
model  in  which  each  component  can  be  abnormal  independent  of  other 
components,  and  the  exclusive  model  in  which  there  is  one  and  only 
one  abnormal  component.  We  develop  index  policies  under  both  models. 
Optimal  low-complexity  algorithms  are  derived  for  the  simple  hypotheses 
case,  where  the  distribution  is  completely  known  under  both  hypotheses. 
Asymptotically  (as  the  error  probability  approaches  zero)  optimal  low- 
complexity  algorithms  are  derived  for  the  composite  hypotheses  case, 
where  there  is  uncertainty  in  the  distribution  parameters.  Simulation 
results  then  illustrate  the  performance  of  the  algorithms. 

Index  Terms — Anomaly  detection,  intrusion  detection,  sequential 
hypothesis  testing. 

I.  Introduction 

An  intrusion  detection  system  (IDS)  is  a  system  that  monitors  the 
network  to  detect  malicious  activities  (i.e.,  attacks)  in  the  network. 
Once  an  IDS  determines  that  a  malicious  activity  has  occurred,  it 
then  alerts  the  security  administrator  or  initiates  a  proper  response  to 
the  malicious  activity.  Good  surveys  of  existing  techniques  for  IDSs 
can  be  found  in  [1] — [14]. 

In  this  paper  we  address  the  problem  of  quickest  localization 
of  anomaly  in  a  resource-constrained  cyber  network.  We  consider 
a  network  with  K  heterogeneous  components  which  can  be  paths, 
routers,  etc.  Assume  that  an  intrusion  has  been  detected  (by  probing 
a  subnet,  for  instance  [14]).  The  goal  here  is  to  locate  the  infected 
components  as  quickly  and  as  reliably  as  possible.  We  focus  on  a 
resource-constrained  intrusion  detection  in  cyber  networks,  as  was 
done  in  [3],  [14],  Due  to  resource  constraints,  only  one  component 
can  be  probed  at  each  time.  The  completion  time  of  component  k 
is  defined  as  the  time  where  the  IDS  completes  testing  component 
k.  Components  are  assigned  priorities.  Components  with  higher 
priorities  in  an  abnormal  state  should  be  fixed  before  those  with  lower 
priorities  to  reduce  the  overall  damage  to  the  network. 

Throughout  this  paper  we  use  the  theory  of  sequential  detection. 
In  sequential  tests,  after  each  observation  has  been  collected,  the 
detector  decides  whether  to  accept  Ho,  reject  Ho  or  to  take  another 
observation.  The  sample  size  achieved  by  sequential  tests  can  be 
significantly  reduced  as  compared  to  fixed-size  tests.  Therefore,  it  is 
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a  natural  approach  for  quickest  localization  of  anomaly.  Sequential 
detection  has  been  extensively  studied  in  the  literature.  Sequential 
detection  using  ordered  transmissions  was  introduced  in  [15].  In  cases 
where  the  measurements  can  be  collected  sequentially  according  to 
a  specific  order,  the  number  of  measurements  required  for  optimal 
detection  can  be  significantly  reduced  [15].  Related  works  on  this 
subject  can  be  found  in  [15] — [18].  However,  this  is  not  the  case  in  the 
IDS  model.  Change-point  detection  techniques  can  be  applied  to  the 
problem  of  anomaly  detection  to  identify  a  change  in  the  probability 
distribution  when  a  malicious  activity  occurs.  Related  works  on  this 
subject  can  be  found  in  [7] — [9] .  However,  in  this  paper  we  consider 
a  different  problem.  In  our  model,  an  intrusion  has  been  detected. 
The  goal  here  is  to  locate  the  infected  components  and  not  a  change 
point.  The  observations  are  drawn  from  two  different  distributions 
depending  on  whether  the  component  is  normal  or  anomalous.  The 
problem  of  sequentially  testing  the  simple  null  hypothesis  Ho  versus 
the  simple  alternative  hypothesis  Hi  was  solved  in  [19].  It  was  shown 
that  the  Sequential  Probability  Ratio  Test  (SPRT)  minimizes  the 
expected  sample  size  under  given  type  /  and  type  II  error  probability 
constraints.  Related  works  on  SPRT-based  solutions  for  anomaly 
detection  can  be  found  in  [2],  [4],  [5],  [12],  [13].  Various  problems 
of  sequentially  testing  the  composite  null  hypothesis  Ho  versus  the 
composite  alternative  hypothesis  Hi  were  studied  in  [20] — [22] .  In 
this  case,  asymptotically  optimal  performance  can  be  obtained  as  the 
error  probability  approaches  zero. 

In  the  following,  we  summarize  the  main  results  of  this  paper. 
We  formulate  the  anomaly  localization  problem  as  a  constrained 
optimization  problem.  The  objective  is  to  minimize  the  expected 
weighted  sum  of  completion  times  of  abnormal  components  (since 
normal  components  do  not  cause  damage  to  the  network)  subject 
to  error  probability  constraints.  We  consider  both  independent  and 
exclusive  models.  In  the  former,  each  component  is  abnormal,  with 
some  prior  probability,  independent  of  other  components.  Under 
the  exclusive  model,  one  and  only  one  component  is  abnormal 
with  some  prior  probability  (which  is  a  reasonable  model  when  the 
probability  of  each  component  to  be  compromised  is  small).  We 
develop  index  policies  under  both  models.  Optimal  algorithms  are 
derived  for  the  simple  hypotheses  case,  where  the  distribution  is 
completely  known  under  both  hypotheses.  Asymptotically  (as  the 
error  probability  approaches  zero)  optimal  algorithms  are  derived 
for  the  composite  hypotheses  case,  where  there  is  uncertainty  in 
the  distribution  parameters.  In  all  cases,  the  algorithms  have  low- 
complexity. 

II.  Network  Model  and  Problem  Formulation 

Consider  a  cyber  network  consisting  of  K  components.  Assume 
that  an  intrusion  has  been  detected.  The  goal  here  is  to  locate 
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the  infected  components.  Due  to  resource  constraints,  only  one 
component  can  be  probed  at  each  time.  When  component  k  is  tested, 
a  sequence  of  i.i.d.  measurements  {yfc(t)};>1  is  drawn  in  a  one-at- 
a-time  manner.  If  component  k  is  in  a  healthy  state,  {yk(i)}i>1  are 
drawn  from  distribution  fj,0'1 ;  if  component  k  is  abnormal,  {yk  (*)}i>:L 
are  drawn  from  distribution  Components  are  assigned  priorities. 
Let  Wk  (0  <  Wk  <  oo)  be  the  priority  (or  weight)  of  component  k. 
Components  with  higher  priorities  in  an  abnormal  state  should  be 
fixed  before  those  with  lower  priorities  to  reduce  the  overall  damage 
to  the  network. 

We  consider  the  case  where  the  switching  cost  is  high.  Thus, 
switching  between  components  is  done  only  when  testing  the  current 
component  is  completed.  The  advantages  of  this  scheme  are  twofold. 
First,  switching  between  components  typically  adds  significant  delay 
that  should  be  avoided.  Second,  the  IDS  is  required  to  store  obser¬ 
vations  of  only  one  component  at  each  time.  Thus,  this  scheme  is 
applicable  to  limited-memory  systems.  For  convenience,  we  define 
tk  as  the  time  where  the  IDS  has  completed  the  ( k  —  l)th  test  and 
starts  the  kth  test.  After  each  observation  has  been  collected,  the  IDS 
needs  to  decide  whether  to  take  more  measurements  from  the  current 
component  or  finalize  the  test  on  the  current  component  by  declaring 
its  state  (healthy  or  abnormal)  and  choose  the  next  component  to  test. 
Let  Nk  be  the  random  sample  size  required  to  make  a  decision 
regarding  the  state  of  component  k.  The  random  completion  time  Ck 
is  defined  as  the  time  where  the  IDS  completes  testing  component  k. 
For  example,  if  the  IDS  tests  component  1  followed  by  component 
2,  then  Ci  =  Ni  and  C2  =  N\  +  W2. 

Let  Tk  be  a  stopping  rule,  which  the  IDS  uses  to  decide  whether 
to  take  more  measurements  from  component  k  or  to  finalize  the 
test  by  declaring  its  state.  The  vector  of  stopping  rules  for  the  K 
components  is  denoted  by  r  =  (n , ....  r^).  Let  5k  £  {0,1}  be  a 
decision  rule,  where  5k  =  0  if  the  IDS  declares  that  component 
k  is  in  a  healthy  state  (i.e.,  Ho),  and  5k  =  1  if  the  IDS  declares 
that  component  k  is  in  an  abnormal  state  (i.e.,  Hi).  The  vector  of 
decision  rules  for  the  K  components  is  denoted  by  <5  =  (<5i , ...,  5k )• 
Let  4>(tk)  £  {1,2,  ,..,  K}  be  a  selection  rule,  indicates  which 
component  is  chosen  to  be  tested  at  time  tk-  The  vector  of  selection 
rules  for  the  K  components  is  denoted  by  <fi  =  (</>(ti), ...,  </>(tx))- 
Finally,  the  set  of  all  the  abnormal  components  is  denoted  by 
Hi  =  {k  :  1  <  k  <  K  ,  component  k  is  abnormal} 

The  problem  is  to  find  a  selection  rule  </>,  a  stopping  rule  r 
and  a  decision  rule  5  that  minimize  the  expected  weighted  sum  of 
completion  times  of  all  the  abnormal  components  subject  to  error 
probability  constraints  for  each  component: 


inf 

E<  WkCk  > 

[fce«i  J 

S.t. 

PkA  <  ak 

Vfc  =  1, . 

..,K  , 

P^D  <  Pk 

Vfc  =  1, . 

••>  K  , 

(1) 


where  P^A ,  PAID  are  the  false-alarm  and  miss-detection  probabili¬ 
ties  at  component  k,  respectively. 

Higher  penalties  are  assigned  to  higher-priority  components  in  an 
abnormal  state1.  No  penalty  is  associated  with  components  in  a 
healthy  state  since  they  do  not  cause  damage  to  the  network. 


'Note  that  the  loss  due  to  missed-detection  events  is  negligible  for  small 
error  probability,  since  PjfD  £  0(1/ Bk)  and  E(Nk)  £  ©(log  Bk),  where 
Bk  is  a  boundary  value  of  the  sequential  test  [19],  [20]. 


III.  Two-stage  Optimization  Problem 

Instead  of  solving  (1)  directly,  we  propose  a  two-stage  optimization 
problem.  At  the  first  stage,  the  problem  is  to  find  a  stopping  rule 
Tk  and  a  decision  rule  5k  for  every  component  k  that  minimize  the 
expected  sample  size  given  Hi  subject  to  error  probability  constraints: 

inf  E{Nk\Hi)  ,  i  =  0,1 

Tk,sk 

s.t.  P£A  <  ak  ,  (2) 

PkM°  <  Pk  ■ 

For  the  simple  hypotheses  case,  the  solution  to  the  first-stage  op¬ 
timization  problem  (2)  is  given  by  the  SPRT  [19].  Let  Lk{n)  = 
U:=ifi1)(yk(i))/U7=ifi0\yk(i))  be  the  Likelihood  Ratio  (LR) 
between  the  two  hypotheses  of  component  k  at  stage  n  and  let  Ak,  Bk 
(Bk  >  Ak)  be  the  boundary  values  used  by  the  SPRT  when  testing 
component  k,  such  that  the  error  constraints  are  satisfied.  According 
to  the  SPRT  algorithm,  at  each  stage  n,  the  LR  is  compared  to  the 
boundary  values  as  follows.  If  Lk(n)  £  (Ak,  Bk),  the  IDS  continues 
to  take  observations  from  component  k.  If  Lk(n )  >  Bk,  the  IDS 
finalizes  the  test  on  component  k  and  declares  it  as  abnormal  (i.e., 
Hi).  If  Lk(n )  <  Ak,  the  IDS  finalizes  the  test  on  component  k 
and  declares  it  as  normal  (i.e.,  Ho).  In  general,  the  exact  determi¬ 
nation  of  the  boundary  values  is  very  laborious.  However,  Wald’s 
approximation  to  the  boundary  values  can  be  applied  to  simplify 
the  computation:  Bk  «  (1  —  /3k)/ak,Ak  «  /3k/(  1  —  ak).  Wald’s 
approximation  performs  well  for  small  ak,  /3k-  Since  type  I  and  type 
II  errors  are  typically  small,  Wald’s  approximation  is  widely  used 
in  practice  [19], 

At  the  second  stage,  the  problem  is  to  find  a  selection  rule  <fi 
that  minimizes  the  objective  function,  given  the  solution  to  the  K 
subproblems  (2): 

inf  E 
<#> 

s.t.  solutions  to  (2)  are  given  for  k  =  1, ...,  K  . 

The  solutions  to  the  second-stage  optimization  problem  for  the 
independent  and  exclusive  models  are  given  in  Section  IV. 

The  formulation  of  the  two-stage  optimization  problem  allows  us 
to  decompose  the  original  optimization  problem  (1)  into  K  +  1 
subproblems  (2)  and  (3).  We  use  this  formulation  to  design  the 
solution  to  (1).  In  subsequent  sections  we  show  that  the  solution  to 
the  two-stage  optimization  problem  solves  the  original  optimization 
problem  (1)  under  both  the  independent  and  exclusive  models. 

IV.  Localization  of  Anomaly  for  the  Simple  Hypotheses 

Case 

In  this  section  we  derive  optimal  solutions  to  both  the  independent 
and  exclusive  models  under  the  simple  hypotheses  case,  where  the 
distribution  under  both  hypotheses  is  completely  known.  Under  the 
independent  model,  each  component  k  is  abnormal  with  a  priori 
probability  Tk  independent  of  other  components.  Under  the  exclusive 
model,  one  and  only  one  component  is  abnormal  with  a  priori 
probability  7 Tk,  where  'Yhk=1’Kk  =  1. 

Based  on  the  solution  to  the  two-stage  optimization  problem,  we 
propose  Algorithms  1,2,  presented  in  Tables  I,  II,  to  solve  (1).  It 
was  shown  in  [23]  that  the  optimal  selection  rule  for  the  problem  of 
minimizing  the  expected  weighted  sum  of  completion  times  given  the 
expected  testing  time  of  each  component  is  to  select  the  components 
in  decreasing  order  of  Wk/E(Nk).  However,  the  problem  in  (3)  is 
different.  First,  the  objective  is  to  minimize  the  expected  weighted 


TABLE  I 

Algorithm  1  for  the  independent  model 


TABLE  II 

Algorithm  2  for  the  exclusive  model 


1.  arrange  the  components  in  decreasing 
order  of  irkwk/ E(Nk ) 

2.  for  k  =  1, K  components  do: 

3.  perform  SPRT  for  component  k, 
with  P[A  <  ak,  P^D  <  pk 

4.  end  for 


1.  arrange  the  components  in  decreasing 
order  of  nkwk/ E(Nk\H0) 

2.  for  k  =  1, K  components  do: 

3.  perform  SPRT  for  component  k, 
with  P[A  <  ak,  PfcMD  <  0k 

4.  end  for 


sum  of  completion  times  of  abnormal  components  only.  Second,  the 
expected  sample  size  depends  on  the  component  state.  Furthermore, 
under  the  exclusive  model,  the  state  of  each  component  depends 
on  other  components.  Here,  we  derive  optimal  selection  rules  that 
solve  the  second-stage  optimization  problem  (3)  for  the  independent 
and  exclusive  models.  These  selection  rules  are  given  in  step  1  in 
Tables  I,  II  for  the  independent  and  exclusive  models,  respectively. 
Arranging  the  components  in  decreasing  order  of  nkwk/E(Nk)  or 
nkwk/E(Nk\Ho)  in  step  1  can  be  done  in  0(K  log  K)  time  via 
sorting  algorithms.  Next,  by  the  optimal  solution  to  (2),  a  series  of 
SPRTs  is  performed  according  to  this  order  until  all  the  components 
are  tested. 

The  index  policies,  described  in  Algorithms  1,2,  are  intuitively 
satisfying.  The  priority  of  component  fc  in  terms  of  testing  order 
should  be  higher  as  the  weight  wk  increases,  or  the  a  priori  probability 
to  be  abnormal  nk  increases.  Under  the  independent  model,  the 
priority  of  component  k  in  terms  of  testing  order  should  be  higher  as 
the  expected  sample  size  E(Nk)  decreases  (since  E(Nk)  is  added 
to  the  completion  time  of  every  component  which  is  tested  after 
component  k).  On  the  other  hand,  under  the  exclusive  model,  the 
priority  of  component  k  in  terms  of  testing  order  should  be  higher 
as  E(Nk\Ho)  decreases.  Note  that  under  the  exclusive  model,  we 
take  into  account  the  expected  sample  size  under  Ho  solely.  The 
reason  is  that  if  component  k  is  abnormal,  there  is  no  penalty  to  other 
components  under  the  exclusive  model  (since  only  one  component 
is  abnormal).  On  the  other  hand,  if  component  k  is  healthy,  then 
E(Nk\Ho)  is  added  to  the  completion  time  of  the  components  which 
are  tested  after  component  k  (and  may  be  abnormal).  The  SPRT  is 
used  in  both  models  to  minimize  the  expected  sample  size  to  reduce 
the  completion  times. 

Note  that  the  solution  to  the  second-stage  optimization  problem 
(3)  requires  one  to  compute  the  expected  sample  size  E(Nk\Hi)  for 
all  k  =  1,2,  and  for  i  =  0, 1  to  select  the  components  in 

decreasing  order  of  nkwk/E(Nk)  or  -nkwk/ E(Nk\Ho).  In  general, 
it  is  difficult  to  obtain  a  closed-form  expression  for  E{Nk\Hi). 
However,  Wald’s  approximation  to  the  expected  sample  size  can 
be  applied  to  simplify  the  computation  [19].  The  approximation 
approaches  the  exact  expected  sample  size  for  small  ak,/3k.  Since 
type  I  and  type  II  errors  are  typically  small,  Wald’s  approximation 
is  widely  used  in  practice  [19].  For  more  details,  the  reader  is  referred 
to  [24], 

Theorem  1:  Under  the  independent  and  exclusive  models,  Algo¬ 
rithms  1,  2,  respectively,  solve  (1). 

The  proof  is  given  in  the  extended  version  of  this  paper  [24], 


Note  that  Algorithms  1,  2  use  static  selection  rules  (as  stated  in  step 
1),  where  the  components  order  is  predetermined  at  time  ti.  However, 
Theorem  1  is  not  restricted  to  static  selection  rules.  Theorem  1  shows 
that  Algorithms  1,2  are  optimal  among  the  class  of  both  static  and 
dynamic  selection  rules  (that  update  the  selection  dynamically  at  each 
time  tk). 

V.  Localization  of  Anomaly  Under  Uncertainty 

In  numerous  cases  under  the  adversary  model,  there  is  uncertainty 
in  the  distribution  parameters  (in  particular  when  the  component  is 
in  an  abnormal  state).  Hence,  in  this  section  we  discuss  the  extension 
of  our  results  to  the  problem  of  localization  of  anomaly  under 
uncertainty.  Due  to  space  limitation,  we  provide  a  general  structure 
of  the  solution  for  this  case.  For  more  details,  the  reader  is  referred 
to  [24],  Under  uncertainty,  asymptotically  optimal  sequential  tests  in 
terms  of  minimizing  the  expected  sample  size  as  the  error  probability 
approaches  zero  can  be  applied  for  testing  every  component  [20] — 
[22] .  Therefore,  we  modify  step  3  in  Algorithms  1,  2,  given  in  Tables 
I,  II  by  performing  an  appropriate  sequential  test  for  composite 
hypotheses  instead  of  the  SPRT.  In  [24],  we  use  the  asymptotically 
optimal  property  of  the  sequential  test,  studied  for  a  single  process,  to 
show  that  the  modified  algorithms  asymptotically  solve  the  original 
optimization  problem  (1)  as  the  error  probability  approaches  zero. 

VI.  Numerical  Examples 

In  this  section,  we  provide  numerical  examples  to  illustrate  the 
performance  of  the  algorithms.  We  compared  three  schemes:  a 
Random  selection  SPRT  (R-SPRT),  where  a  series  of  SPRTs  are 
performed  until  all  the  components  are  tested  in  a  random  order,  and 
the  proposed  Algorithms  1,  2,  which  are  optimal  for  the  independent 
and  exclusive  models,  respectively. 

We  consider  an  intruder  that  tries  to  launch  a  Denial  of  Service 
(DoS)  or  Reduction  of  Quality  (RoQ)  attacks  by  sending  a  large 
number  of  packets  to  a  component  (which  can  be  a  relay  node  in 
this  application).  DoS  attacks  rely  on  overwhelming  the  component 
with  useless  traffic  that  exceeds  its  capacity  so  to  make  it  unavailable 
for  its  intended  use.  On  the  other  hand,  RoQ  attacks  inflict  damage 
on  the  component,  while  keeping  a  low  profile  to  avoid  detection. 
RoQ  attacks  do  not  cause  denial  of  service.  In  order  to  detect 
such  attacks,  the  IDS  performs  a  traffic-based  anomaly  detection.  It 
monitors  the  traffic  at  each  component  to  decide  whether  a  com¬ 
ponent  is  compromised.  Similar  traffic-based  detection  techniques 
were  proposed  in  [6],  [11]  for  different  models,  considering  a  single 
process  without  switching  to  other  components.  For  each  component 
k,  we  assume  that  packets  arrive  according  to  a  Poisson  process 
with  rate  9^.  When  component  k  is  tested,  the  IDS  collects  an 


observation  ykift)  £  No  every  time  unit,  which  is  the  number  of 
packets  that  arrived  in  the  interval  (n  —  1  ,  n).  We  consider  the  case 
where  6  k  =  6 ^  under  normal  state  and  Ok  =  6^  =  1.5-  6^  under 
abnormal  state  are  known  to  the  IDS.  Let  8k  =  (100—  10 )/(K—  1). 
We  set  Wk  =  6^  =  10  +  (k  —  1  )8k-  By  setting  Wk  =  0*.  , 
the  objective  function  represents  the  total  expected  number  of  failed 
packets  in  the  network  during  DoS  attacks.  Thus,  the  optimization 
problem  can  be  observed  as  minimizing  the  maximal  damage  to  the 
network  in  terms  of  packet-loss.  Furthermore,  this  setting  prioritizes 
components  with  higher  normal  traffic  to  reduce  the  delay  caused  by 
RoQ  attacks.  The  error  constraints  were  set  to  P/f A  =  ID  =  10-2 
for  all  k.  For  the  independent  and  exclusive  models,  we  set  ivk  =  0.8 
and  7Tfc  =  1/K  for  all  k ,  respectively.  The  performance  of  Algorithm 
1  and  Algorithm  2  are  presented  in  Fig.  1,  as  compared  to  the  R- 
SPRT.  It  can  be  seen  that  the  proposed  Algorithms  save  roughly 
50%  of  the  objective  value  as  compared  to  the  R-SPRT  under  both 
the  independent  and  exclusive  model  scenarios. 


Fig.  1.  Objective  value  as  a  function  of  the  number  of  components  for  the 
independent  and  exclusive  model  scenarios. 


VII.  Conclusion 

The  problem  of  quickest  localization  of  anomaly  in  a  resource- 
constrained  cyber  network  was  investigated.  Due  to  resource  con¬ 
straints,  only  one  component  can  be  probed  at  each  time.  The  obser¬ 
vations  are  random  realizations  drawn  from  two  different  distributions 
depending  on  whether  the  component  is  normal  or  anomalous.  Com¬ 
ponents  with  higher  priorities  in  an  abnormal  state  should  be  fixed 
before  components  with  lower  priorities  to  reduce  the  overall  damage 
to  the  network.  The  objective  is  to  minimize  the  expected  weighted 
sum  of  completion  times  subject  to  error  probability  constraints.  For 
the  simple  hypotheses  case,  we  derived  optimal  algorithms  for  both 
the  independent  and  exclusive  models.  For  the  composite  hypotheses 
case,  we  derived  asymptotically  (as  the  error  probability  approaches 
zero)  optimal  algorithms  for  both  the  independent  and  exclusive 
models.  These  optimal  algorithms  have  low-complexity. 
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